Blog

What Happens in the First 24 Hours of a Cyber Attack?

Image: Pixabay via Pexels

When a cyber attack hits, the first 24 hours are often the difference between a contained incident and a full-blown crisis. It’s a window that moves fast — and without a plan, organisations can find themselves scrambling in exactly the wrong direction. Understanding what that timeline looks like can help you prepare well before you ever need to use it. It also explains why the monitoring you put in place ahead of time — like the Huntress platform now built into our managed security service — matters more than almost anything you can do once the clock is already running.

The Clock Starts the Moment Something Feels Wrong

It rarely begins with flashing red alerts. More often, it’s something subtle — a staff member can’t log in, files look corrupted, or a system is behaving oddly. The first hour is about detection and confirmation. Is this a technical glitch, or something more serious? Your IT team (or your MSP) needs to triage quickly, because every minute of uncertainty is a minute the attacker may still have access.

This is exactly where round-the-clock monitoring earns its keep. The Huntress platform we’ve added to our security stack uses behavioural analysis — not just known threat signatures — to surface the subtle signals an attack leaves behind, often well before a staff member notices anything is wrong. And because it’s backed by a human-led Security Operations Centre running 24/7, an experienced analyst is investigating that signal within minutes — confirming whether it’s a harmless glitch or a genuine breach, so the clock doesn’t keep ticking while people debate.

This is also the moment communication protocols matter. Who gets called first? Who has authority to pull systems offline if needed? If those answers aren’t documented somewhere, valuable time is lost figuring it out under pressure.

Hours Two to Six: Containment Over Everything

Once an incident is confirmed, the priority shifts to containment — stopping the spread before more damage is done. This might mean isolating affected devices from the network, resetting compromised credentials, or temporarily taking systems offline. It’s rarely a comfortable call, but it’s almost always the right one.

Forensic evidence also needs to be preserved during this window. Logs, memory snapshots, and system states can be critical later — both for understanding what happened and for any legal or regulatory obligations. Acting too quickly without thinking about evidence can inadvertently destroy information you’ll later wish you had.

For our clients, much of this now happens with the Huntress Security Operations Centre working hand-in-hand with our own team. Analysts can isolate a compromised device remotely, halt the spread, and preserve the logs and system states in the same motion — so containment doesn’t come at the cost of the forensic evidence you’ll need later. It turns the most stressful hours of an incident into a coordinated, well-practised response rather than an improvised scramble.

Hours Six to Twenty-Four: Assessment, Notification, and Recovery Planning

With containment underway, attention turns to understanding the scope. What data was accessed? What systems were affected? Were any third parties — clients, suppliers, or cloud platforms — potentially compromised?

Depending on the nature of the incident, you may have legal obligations to notify affected parties or the Office of the Privacy Commissioner under New Zealand’s Privacy Act 2020. Getting legal and communications teams involved early is important here — not just for compliance, but for managing trust with the people who depend on you.

A recent threat report from CyberCX highlights that the threat landscape for organisations across Australia and New Zealand is continuing to worsen heading into 2026, with attackers becoming faster and more sophisticated. That makes the preparation you do now — before an incident — even more valuable than any response you could mount in the moment.

The Real Lesson: Preparation Is the Response

The organisations that navigate incidents well aren’t necessarily the ones with the biggest IT budgets. They’re the ones with a tested incident response plan, clear communication chains, a relationship with a trusted IT partner who knows their environment, and always-on detection and response watching over it all. When everyone — and everything — knows its role, the first 24 hours feel manageable rather than chaotic.

That’s precisely why we’ve made Huntress a core part of the protection we provide. It means the critical first 24 hours are already covered by expert eyes, 24/7, without adding anything to your team’s daily workload — long before an incident ever begins.

If you’re not sure whether your organisation has what it needs, our team is always happy to help you work through it — before you ever need to put it into practice.

Chris Drowley
General Manager, Resolve Technology
Outside the office, Chris runs a highly organised empire of model trains — where the schedules are always on time, unlike the real thing.